Claim your link

Privacy Policy

Last updated October 18, 2026

This policy explains what Link.bio (“we”, “us”) collects when you visit link.bio or use your account, why we collect it, and the choices you have. We keep it short and only collect what we need to run the service.

What we collect

  • Account details. Your username, email address and password when you sign up. We never store your password itself, only a one-way scrambled version (an Argon2id hash) that can’t be turned back into the password.
  • Login sessions. When you log in, we create a session for that device. We store the date and time, your IP address and your browser’s user agent (for example “Chrome on Mac”), so you can see and log out of your devices on your dashboard and so we can spot suspicious activity.
  • Security counters. To stop password guessing and spam, we count recent login and signup attempts. These counters are stored in a scrambled form and deleted within an hour.
  • Server logs. Like most websites, our servers record basic request details (IP address, page requested, browser, time) to keep the site running and secure.
  • Your public page. Anything you add to your Link.bio page, such as your name, bio, photo, links, social icons, embedded videos or music, and your design, is public once you publish the page. That’s the point of the page, so only add what you’re happy for anyone to see.
  • Pictures you upload. Profile pictures, link thumbnails and background images are resized and re-saved by us, which removes hidden information such as the location a photo was taken. They’re stored under random file names and shown on your public page.
  • Visits to Link.bio pages. When someone visits a page or taps one of its links, we add one to that day’s totals: views, clicks per link, the site the visitor came from (just its name, like “Instagram”), their country (provided by Cloudflare) and their type of device (mobile, tablet or desktop). We don’t store visitors’ IP addresses, set cookies on public pages, or keep anything that identifies a visitor in these statistics. Page owners see the totals in Insights. Visits by search engine bots and by the page owner aren’t counted.
  • Messages you send us. When you use our contact form, we store your name, email address, the topic, your message, your IP address and browser, and your account if you’re logged in, so we can reply and prevent spam.
  • Earlier username claims. If you claimed a username before accounts launched, we stored that username, your email address, your IP address and the time of the claim.

When you type a username and email into the claim form on our home page, they’re carried over to the signup form. Nothing is saved until you create your account.

How we use it

  • To create and run your account and your page, and to keep you logged in.
  • To show page owners how many people view their page and click their links (as totals only).
  • To protect your account and the service: detecting abuse, blocking repeated failed logins, and investigating problems.
  • To answer messages you send us.
  • To contact you about your account, for example about security or important changes to the service.

We don’t sell your personal information, we don’t show ads, and we don’t use your data to build advertising profiles.

Cookies

We only use cookies that the site needs to work. There are no advertising or analytics cookies.

  • __Host-lb_session keeps you logged in. It contains only a random code, never your name or email. It lasts 30 days if you choose “Remember me” (and after signing up), otherwise until you close your browser.
  • __Host-lb_csrf protects our forms from being submitted by other websites. It lasts until you close your browser.

Cloudflare, which protects our site, may set its own short-lived security cookies to tell people and bots apart.

Who else handles your data

We use a few service providers to run Link.bio. They only get what they need to provide their service to us:

  • Our hosting provider runs the servers where your account data is stored.
  • Cloudflare delivers and protects the website, so your requests (including your IP address) pass through it.
  • Google Fonts serves the fonts on our pages and on public pages that use a custom font, so your browser contacts Google’s servers, which receive your IP address and browser details.
  • YouTube, Spotify and SoundCloud power the players that page owners can embed. A player only loads after a visitor taps play; from then on that provider receives the visitor’s IP address and browser details, and its own privacy policy applies. YouTube videos use its privacy-enhanced (no-cookie) mode.

When we start sending emails (for example to verify your address or reset your password), we’ll use an email delivery provider and update this policy first. We may also share information if the law requires it, or to protect the safety of our users or the public.

How long we keep it

  • Account details: for as long as you have an account.
  • Login sessions: deleted when you log out, when you log a device out from your dashboard, or when the session expires (after 30 days, or 24 hours without “Remember me”). Expired sessions are cleaned up every hour.
  • Security counters: deleted within an hour.
  • Contact messages: kept for as long as we need them to help you, then deleted.
  • Page statistics: daily totals are kept for 400 days, then deleted.
  • Deleted links: kept in the trash for 30 days so you can undo a mistake, then deleted with their thumbnails.
  • Backups: we keep daily backups of our database for 14 days, so deleted data disappears from backups within 14 days.
  • Server logs: kept for a limited time for security and troubleshooting, then deleted.

If you delete your account, we immediately delete your account details, your sessions, your page, its statistics and your uploaded pictures (and they leave our backups within 14 days). Your username becomes free for someone else to claim.

Your choices and rights

You can download a copy of your data and delete your account yourself, at any time, in your dashboard’s Settings. You can also ask us to show you the personal information we hold about you, correct it, give you a copy, or delete it along with your account. You can also object to how we use it. Email us at support@link.bio from the address on your account and we’ll respond within 30 days. Depending on where you live, you may also have the right to complain to your local data protection authority.

Security

The whole site uses HTTPS. Passwords are hashed with Argon2id, login cookies can’t be read by scripts on the page, only a scrambled version of your login code is stored on our side, and you can log out of every device at once from your dashboard. No system is perfectly secure, so please use a password you don’t use anywhere else.

Children

Link.bio is not meant for children under 13, and we don’t knowingly collect their information. If you believe a child under 13 has created an account, please contact us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top. If the changes are significant, we’ll let you know through the site or by email before they take effect.

Contact

Questions about privacy? Email support@link.bio.